HL7 FHIR Consent Resource: Privacy Directives, Research eConsent, and 42 CFR Part 2 Segmentation

The HL7 FHIR Consent resource (Consent) is the normative Fast Healthcare Interoperability Resources (FHIR) data structure used to record, exchange, and machine-enforce a healthcare consumer’s or research participant’s legal choices regarding the collection, access, use, or disclosure of health information, treatment authorization, or clinical trial participation. In modern EHR integration and health information exchange (HIE) architectures, Consent replaces static scanned PDF signature pages with computable access-control rules (`provision` blocks) that API gateways can evaluate in real time.

What Is FHIR Consent and How Is It Used in Clinical Research and Healthcare?

Defined in the HL7 FHIR Release 4 specification (hl7.org/fhir/R4/consent.html), the Consent resource models four distinct legal and clinical domains through its mandatory scope element (bound to http://terminology.hl7.org/CodeSystem/consentscope):

1. Patient Privacy (patient-privacy): Authorizes or restricts who may access or disclose electronic protected health information (ePHI) across providers, payers, and HIEs—including HIPAA authorizations and granular substance use disorder (SUD) directives under 42 CFR Part 2.
2. Clinical Research Participation (research): Captures informed consent for human subjects research protocols, biobanking, secondary EHR data reuse, and decentralized clinical trial (DCT) electronic informed consent (eConsent).
3. Treatment Consent (treatment): Records informed consent or refusal for specific surgical, diagnostic, or medical procedures.
4. Advance Care Directives (adr): Captures living wills, Do Not Resuscitate (DNR) orders, and healthcare proxy designations.

FHIR R4 Element	Cardinality & Type	Technical Role & Invariant Rules
status	1..1 (code)	Lifecycle state: draft | proposed | active | rejected | inactive | entered-in-error. Only active resources grant or block access in production enforcement engines.
scope	1..1 (CodeableConcept)	High-level domain: patient-privacy, research, treatment, or adr. Under FHIR invariant ppc-2, if scope=patient-privacy, patient is mandatory.
category	1..* (CodeableConcept)	Specific classification (e.g., LOINC 59283-0 Consent Document, 64292-6 Release of Information, or HL7 Research Informed Consent codes).
patient	0..1 (Reference(Patient))	Links the directive to the FHIR Patient resource whose records or participation are governed.
policy / policyRule	0..* / 0..1	Identifies the governing legal statute or jurisdictional rule (e.g., HIPAA Authorization, 42 CFR Part 2, Common Rule). Invariant ppc-1 requires either policy or policyRule to be present.
provision	0..1 (BackboneElement)	Recursive computable rule tree specifying type (deny or permit), period, actor, action, securityLabel, purpose, class, and nested child provision[] exceptions.

What Standards or Regulatory Requirements Govern FHIR Consent?

In U.S. health IT and clinical research, computable FHIR Consent workflows are governed by three overlapping federal regulatory frameworks:

• 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records): Under the 2024 HHS/SAMHSA Final Rule aligning 42 CFR Part 2 with the CARES Act and HIPAA, patients may sign a single consent for future Treatment, Payment, and Health Care Operations (TPO) disclosures, but SUD counseling notes require separate explicit consent and records remain subject to strict redisclosure prohibitions and legal-proceeding shields. FHIR Consent pairs with the HL7 Data Segmentation for Privacy (DS4P) standard, matching Consent.provision.securityLabel against FHIR resource meta.security tags (such as ETH for substance abuse or PSY for psychiatry) to filter restricted records before API transmission.
• HIPAA Privacy & Security Rules (45 CFR Part 164): Standardizes electronic authorizations under 45 CFR § 164.508 and enforces technical access controls under the HIPAA Security Rule (45 CFR § 164.312(a)(1)).
• FDA 21 CFR Part 50 & HHS Common Rule (45 CFR Part 46): In clinical trials, FHIR Consent resources with scope = research link the participant’s electronic signature (via a FHIR Provenance.signature or PDF sourceAttachment) to the specific IRB-approved protocol version (`ResearchStudy`), tracking tiered opt-ins for genomic sequencing or future biospecimen reuse.

How Does FHIR Consent Integrate with EHR and Health Informatics Workflows?

The JSON example below illustrates an active FHIR R4 Consent resource implementing a base permit rule for Treatment, Payment, and Operations (TREAT, HPAYMT, HOPERAT) while nesting a child deny provision that blocks disclosure of resources tagged with the HL7 confidentiality security label for psychotherapy/SUD counseling notes:

{
  "resourceType": "Consent",
  "id": "part2-tpo-with-counseling-exclusion",
  "status": "active",
  "scope": {
    "coding": [{
      "system": "http://terminology.hl7.org/CodeSystem/consentscope",
      "code": "patient-privacy"
    }]
  },
  "category": [{
    "coding": [{
      "system": "http://loinc.org",
      "code": "59283-0",
      "display": "Consent Document"
    }]
  }],
  "patient": { "reference": "Patient/example-patient-101" },
  "dateTime": "2026-11-09T14:30:00Z",
  "policyRule": {
    "coding": [{
      "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
      "code": "OPTIN"
    }]
  },
  "provision": {
    "type": "permit",
    "purpose": [
      { "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason", "code": "TREAT" },
      { "system": "http://terminology.hl7.org/CodeSystem/v3-ActReason", "code": "HPAYMT" }
    ],
    "provision": [
      {
        "type": "deny",
        "securityLabel": [{
          "system": "http://terminology.hl7.org/CodeSystem/v3-ActCode",
          "code": "PSY",
          "display": "psychiatry disorder information sensitivity"
        }]
      }
    ]
  }
}

When an external client queries a US Core FHIR server or TEFCA Qualified Health Information Network (QHIN), the authorization policy decision point (PDP) evaluates active Consent resources for that patient, compares the requester’s OAuth 2.0/SMART token purpose-of-use claim against Consent.provision, and redacts any FHIR resources matching a deny provision.

Frequently Asked Questions

What is FHIR Consent and how is it used in clinical research and healthcare?

The HL7 FHIR Consent resource is a standardized JSON/XML data structure that records a patient’s or research participant’s legal permissions and restrictions across four scopes: patient privacy directives, clinical research informed consent (eConsent), medical treatment consent, and advance care directives.

What standards or regulatory requirements govern FHIR Consent?

FHIR Consent implementations are governed by the HL7 FHIR R4 specification, the HL7 Data Segmentation for Privacy (DS4P) security labeling vocabulary, HIPAA Privacy Authorization rules (45 CFR § 164.508), SAMHSA substance use disorder confidentiality rules (42 CFR Part 2), and FDA/OHRP human subjects research regulations (21 CFR Part 50 and 45 CFR Part 46).

How does FHIR Consent integrate with EHR and health informatics workflows?

EHRs and health information exchanges store active FHIR Consent resources linked to the Patient resource and evaluate the nested provision tree (permit/deny rules, authorized actors, valid date periods, and DS4P security labels) at the API gateway before returning clinical resources to external queries.